General

Part #6: Alleged FBI Tampering: Accidental Discovery of Child Porn on Hard Drive

·
by
Frank Parlato
Frank Parlato

Frank Parlato

Suneel Chakravorty

Part #1: Analysis of Allegations of FBI Tampering in USA v Raniere

Part #2 Analysis of FBI Tampering Daniela and Her Relationship With Raniere and Computers

Part 3: Analysis of Alleged FBI Tampering — Camila

Part #4 Analysis of Alleged FBI Tampering: The Search of 8 Hale and the Wrong Picture of the Hard Drive

Part #5 Alleged FBI Tampering: Delay, Delay, and Hide the Camera Card

Part # 5 ended with AUSA Moira Kim Penza predicting a superseding indictment.

On November 6, 2018, AUSA Penza told Magistrate Judge Vera Scanlon:

Your Honor, I believe the Government has been more open than we often are in these cases. We were asked twice by Judge Garaufis and we said we expect a superseding indictment at some point.

She did not say what the new charges might be.

Part 6

On November 14, Raniere asked for bail a second time. For the first time, the DOJ revealed their theory that Raniere had relations with Camila when she was underage.

November 19


The DOJ opposed Raniere’s second bail application. They possessed alleged evidence of him having sex with a “first-line” DOS “slave” when she was 15.


This was Camila. They mentioned her alleged diary.


The government has obtained evidence that the defendant began having a sex with a “first-line” DOS “slave” when she was fifteen years old and he was forty- six.

Among other sources of evidence, journal entries written by the DOS slave before her eighteenth birthday reflect an ongoing sexual relationship with the defendant.

The date of Camila’s diary is July 2007. She does not mention Raniere by name, but refers to a “teacher” she had sex with.

She was 17, above the age of consent, in New York. The DOJ did not use the diary as evidence at the trial.


The DOJ’s evidence of a relationship with 15-year-old Camila came from a search of Raniere’s emails. There was an attachment to an email that appears to be a text copy of Whatsapp chats between Camila and Raniere.


The chats occurred when Camila was in her mid-twenties.  One email is much older, sent by Camila when she was 19. They do not paint a pretty portrait of Raniere.


First the email.


30 Full Moons

This email was dated Thursday at 1:01:14 AM, February 21, 2008. Camila was almost 19 on that date. Camila sent it to Raniere.

Subject Full moon.

Full moon is tomorrow and that would make it 30 full moons that we’ve been together. Smiley face.

Subtracting 30 full moons from February 21, 2008, takes us back to the Harvest Moon, September 17, 2005.

Camila was attentive to the moon’s phases, said her family and friends. She would calculate by the lunar calendar. If the date is correct, she is wrong about the full moon. The full moon was not tomorrow, but that day, February 21. She sent the email after midnight. She might have spoken figuratively as if it was still Wednesday.

The Chats

There are seven probative chats. Six are evidence of an underage relationship. One chat is evidence of photographs.


Of the chats suggesting an underage relationship, some point to Camila being 15. Others to age 16. In New York, the age of consent is 17. Raniere is 30 years older than Camila.

[#1] 8.75 years

September 4, 2014. Camila is 24. This is from the document of WhatsApp chats.

Raniere writes:

It is such a painful, bittersweet thing… The truth of our life together that could have been made real yet now is forever a secret and nullified… I love you so much…I’m so proud to have been your husband for 8.75 years… and shared a home for 4… Yet I am also so heart broken.

 

It may seem odd that Raniere used a fraction like 8.75 for years and months. It suggests precision. If we subtract 8.75 years from September 4, 2014, the relationship started on December 4, 2005. She was 15.


If Raniere’s 8.75 is accurate, he is off by 25 percent when they shared a home. Evidence at trial showed the lease of 120 Victory Way started June 28, 2011. That was three years, not four.


If we add a year, she was 16 and still underage. Camila did not respond to this text.


[#2] 8.5 years

Raniere again uses fractions. Where others might say eight and a half years, or eight years and six months, he says 8.5 years.




October 15, 2014


Raniere: Why else would you feel that way?

Camila: I am not disagreeing.

Raniere: Besides, you do not need that to do the right thing… Breaking up is the wrong thing considering that and 8.5 years… Fix first and never use breakup as a possibility…

Subtracting 8.5 years from October 2014, we get March 2006. Camila would be 16. Still underage.


[#3] 8.5 -Years #2.

A month later, on November 12, 2014, Raniere still uses 8.5 years.


Raniere: That is the summation of our 8.5 years together


This would bring the start to April 2006. Camila was 16.

[#4] 9 Years

Within the month, Raniere upped the relationship by six months, bringing the start back to age 15.

November 27, 2015

Camila: Please don’t be like this.
Raniere: Have I earned what I am demanding? If so, it is not cruel to demand it absolutely. If not, just leave. There is no cruelty. You though give me uncertainty when I have earned so much more over 9 years. 9 years plus the things you’ve done are cruel. Calling me cruel in light of that is cruel.

Nine years brings it to November 2005. She was 15, and this is close to the November 2 metadata date of the first set of photos.


[#5] Anniversary Text

Chat of September 18, 2015.

Camila: Happy Anniversary, honey! ten years ago you changed my life.
Raniere: I love you, sweetheart!

FBI agents believed “anniversary” meant the date Raniere first had sex with a woman. For example, Daniela’s anniversary was November 2 – the Day of the Dead.


Subtracting ten years, this means Camila first had sex with Raniere on September 18, 2005. Camila was 15. This ties in with the full moon email. It also ties in with the date Camila said was her anniversary with Raniere – at his sentencing.

[#6] Inexperienced 15-year-old

December 27, 2015,

Raniere: How many attractive, not socially defective virgins would give their life to someone like me at my age?

Camila: Ummm, all of them? You are handsome, sexy, strong, gentle, loving, funny, talented, have a beautiful smile, eyes, loving touch. What woman wouldn’t want that? You know for a fact that they all want you.

Raniere: Even an inexperienced 18-year-old?

Camila: Even an inexperienced 15-year-old.

Raniere: Would need to be a once in a lifetime person, and I had that and lost it.

By the end of 2018, FBI agents had read hundreds of texts between Raniere and Camila. In these, Raniere often laments how Camila had been with another man. They believed Raniere referred to Camila as the “once-in-a-lifetime” lost 15-year-old.


Statutory rape is a state crime. But federal law makes taking lascivious photographs of someone under 18 illegal. It is sexual exploitation of a minor. Possessing such photos is possession of child porn.


The next chat pointed to a federal crime.

[#7] Guard the Photos

February 1, 2015. Camila is 25. She texts him a photo.

Camila: Guard these pics, okay?

Raniere: Yes, of course…. You know I guard the other pictures, right?

***

Camila: From way back when?

Raniere: I wanted the original forever. I thought it was truly mine. Yes, from way back.

This might mean Raniere kept photos of Camila from years ago. He said he guarded them. If the photos on the hard drive were the originals, he did not guard them well. As of February 2015, he had not forgotten them. By November 2017, the FBI said he fled to Mexico, abandoning them.


The FBI focused on Camila. They met with her sister, Daniela, at least a dozen times, according to her testimony. They met with her brother, Adrian.


They learned about Camila’s appendectomy and how it left a scar. The FBI got the medical records. They knew the date of her operation was January 9, 2007, when she was 16. They would later argue that any photo without a scar should prove she was underage when she posed.


December 5

Judge Nicholas G. Garaufis denied Raniere’s bail application.

2019

The new year started with the promise of a superseding indictment.

January 9

AUSA Penza said the DOJ expected new charges.

Penza said: “Obviously, the government is cognizant of the trial date that is set as of now, and we are moving expeditiously.”

January 11

Two days later, the DOJ moved to adjourn the trial. Agnifilo objected. He claimed the DOJ was stalling.

The government’s adjournment bag is now empty. There are no more defendants to add. There are no more superseding indictments on which to ruminate. It has to try the case. No more excuses. No more delay.

January 15

The judge adjourned the trial date to April 29. 2019

February 11

Discovery Hearing before Magistrate Judge Scanlon

AUSA Penza assured the Court that the Defendants “have everything from 8 Hale.”
That wasn’t true. A forensic copy of the camera card was not given to the defense. In fact, it was not disclosed that it existed. FBI agents checked it out twice for review by that date.

Raniere’s appellate lawyer, Joseph Tully, wrote that this was an instance of “the government misleading the Court and the Defense into believing that evidence had been disclosed when it indeed had not.”

February 21

In 26 days, 500 people would be part of a pool for jury selection. There were 17 lawyers representing six defendants.

Marc Agnifilo (Raniere)

Teny Geragos (Raniere)

Paul DerOhanessian (Raniere)

Jacob Kaplan (Raniere)

Sean Buckley (Mack)

William McGovern (Mack)

Steven Kobre (Mack)

Susan Necheles (Bronfman)

Kathleen Cassidy (Bronfman)

Gedalia Moshe Stern (Bronfman)

Mark Geragos (Bronfman)

Hector Diaz. (L. Salzman)

James L. Burke (L. Salzman)

Justine Harris (Russell)

Amanda Ravich (Russell)

David Stern (N. Salzman)

Robert Soloway (N. Salzman)

FBI agents continued their search of the Western Digital hard drive [evidence item #2]. It was ten months and 26 days after the FBI seized the hard drive (332 days).

They found juvenile photos of Camila from 2005 by accident, they said. They said they were not looking for photos of underage Camila. SA Lever swore in an affidavit that the FBI was searching for crimes that occurred on or after January 1, 2015.

The warrant authorized searching for evidence of sex trafficking, forced labor, extortion, and racketeering involving Raniere that occurred on or after January 1, 2015.

Then they accidentally found the 2005 photos, Lever said.

Judge Garaufis described the FBI agents’ accidental discovery:



On February 21, 2019, while searching the Device pursuant to the 8 Hale Warrant, FBI
agents found the Images, two digital images of a nude female whom the agents believed to be under the age of eighteen. (Second Lever Aff. 11-12.)

The agents recognized this female as a DOS slave who they believed had sex with Raniere when she was fifteen. (Id fll 9-11.)


The Images’ metadata indicate that they were taken on or before November 2, 2005—a date on which the DOS slave in question was fifteen years old—and that they were taken on a camera seized from 8 Hale.” (Id UK 12-14.) The Images were also in a folder dated November 2, 2005.


As described in the February Warrant, the images depict a minor female who was known to law enforcement at the time the images were discovered, and who, subsequent to the photographs, became a first-line DOS “slave.” (Att. 2 ¶¶ 9-10).


The minor victim is shown in sexually explicit poses that are similar to those shown in the “collateral” photographs of other DOS members, obtained by the government pursuant to grand jury subpoenas and search warrants for the defendant’s email. (Id. ¶ 11).


So what happened?


The FBI was searching a black Western Digital hard drive. There was a parent folder called ‘Studies’.’ Inside were 11 sub-folders. Each sub-folder contained nude photos. According to testimony at trial, most photos were closeups of vaginas and no face. Some photos showed the faces of women. Each sub-folder had names that began with one or more letters, followed by a date in 2005. Each sub-folder contained photos of women known as Raniere’s sexual partners. Each started with the initial of her name or nickname.


Lever said he checked the metadata. He discovered that someone used the Canon camera [evidence item #1] to take the photos in 2005.


Lever said he saw two photos of Camila with her face and vagina.


The ‘V’ stood for her nickname – Virgin Cami, he believed. The 110205 on the folder stood for 11-02-2005. The Day of the Dead.


Camila was 15 in 2005.


Raniere was a dead man.


Before February 21, 2019, the DOJ’s case involved adult victims. Adults may consent or not. But a child cannot consent. This was evidence of a serious and repugnant federal crime. Possession of child pornography. The EXIF metadata showed the date of the photo was November 2, 2005, the same as the sub-folder name. The EXIF data showed the Canon camera took the photos.


There was another sub-folder name that appeared computer-generated. It corresponded to the November 2, 2005 date. Three things corresponded to the November 2, 2005 date.


The EXIF data, Raniere’s alleged name for the file, and a computer-generated name. There was contradictory metadata, which we will discuss later.


The EXIF date showed someone used the Canon camera to take Camila’s photographs. The DOJ alleged Raniere took the photos with his Canon camera.


This was a second crime. Sexual exploitation of a minor.


Lever knew Camila had appendix surgery on January 9, 2007, when she was 16. According to testimony at trial, there was no scarring on these photos. There was a second sub-folder within the V110205 folder.


There were eight more photos of Camila. The metadata showed the Canon camera took these photos on November 24, 2005.


The Second Circuit held that two is the threshold. Two times means “that a defendant is a “Repeat and Dangerous Sex Offender Against Minors.” Raniere engaged in a “pattern of activity involving prohibited sexual conduct.”


“Proof of any two separate occasions of prohibited sexual conduct” means a “§ 4B1.5(b) enhancement.”


Agnifilo could no longer claim these were adult women. Did Raniere forget? Was he careless?


The FBI had chats that supported the photos dating. They had these before their accidental discovery on the hard drive.


They had her medical records for an appendectomy before their accidental discovery. Raniere let Camila know he guarded photos from way back when.


Then he fled to Mexico, according to the FBI, and left a hard drive on a bookshelf. He knew he was under investigation. That’s why he fled, the DOJ said in their bail opposition papers. In those same papers, the DOJ said he ditched his phone and stopped using unencrypted email.


A video made by Mark Vicente in 2012 shows a black hard drive with a blue light. Right where FBI agents said they seized it six years later. Though SA Mills photographed the wrong device.


If no one tampered with the metadata, no one had been on the hard drive since February 2010.

Daniela testified she ran his computers and backups to hard drives. It was a month before she stepped into the room.

Daniela testified she found a “hidden folder” of nude women. It might have been the Studies folder based on her description. She testified she told Raniere that anyone might find the nude photos if she could find them.

Unlike the nude photos Daniela found in a hidden file, the Studies photos were not hidden. They were next to music folders Daniela digitized. The dates of the doomsday photos had a coincidence.

The Day of the Dead. Daniela’s “comical” anniversary of first sex with Raniere. The Camila photos were dated November 2, 2005.

The day the FBI discovered the photos, the DOJ instructed the defendants’ attorneys to destroy the hard drive copies. It contained child pornography. Lever had to apply for a new warrant to broaden the scope of a search for child porn. His affidavit states his discovery of the child porn on the hard drive took place on February 21, 2018. That would mean Lever inspected the hard drive before the FBI arrested Raniere. The judge said Lever meant to write February 21, 2019, not 2018.

. According to Judge Garaufis, it was a typo, not a Freudian error.

A photo of a Lexar camera card similar to the one inside the Canon camera seized at 8 Hale.


At 3:08 pm, SA Lever checked the camera and camera card out of evidence control. The existence of the camera card was not yet disclosed to the defense. It would be in about six weeks.


Lever kept the camera and card overnight.


February 22

On the day after Lever discovered child porn, he brought the camera and camera card to CART.

It was 333 days after the FBI seized it. CART forensic examiner Stephen Flatley took custody.

SA Lever took the black Western Digital hard drive from ECU. SA Lever gave “SW,” presumably meaning “search warrant,” as the reason for checking it out of ECU.

It is unknown what actions SA Lever took on the hard drive or who took custody of the device afterward. The hard drive disappears from the chain of custody. For reasons unknown, the hard drive never appears again on the FBI chain of custody.

It appeared at the trial, but what happened afterward is not known based on the custody report. It is unknown who has custody of it now. Or if it still exists.

Metadata led the FBI to assert when Raniere took the photos.


Metadata showed, the DOJ alleged, Raniere used a Canon EOS 20D camera. He saved them to a Lexar CF card. The DOJ had not disclosed they had the camera card yet.


The Canon with the camera card was the first item seized at 8 Hale. Evidence Item #1.


The DOJ’s theory was that Raniere took the photos in the fall of 2005. He used the camera card to upload them to a Dell Dimension 8300 computer – which was never found.

A photo of a Dell Dimension 8300, not the actual computer, the FBI alleged Raniere used. The FBI did not find the Dell computer.

 

On the Dell, Raniere allegedly created a folder called Studies.

There were sub-folders in this Studies folder. Each sub-folder had initial[s] (or nicknames) to show who the subject was and the date of the photos.

Within the folders were sub-folders with what appeared to be computer-generated file names. The computer-generated names “roughly” matched the EXIF DateTimes.

The word “roughly” was the word FBI Senior Forensic Examiner Brian Booth used at trial.

Three things matched. The EXIF DateTime, the folders named after initials, and the computer-generated folder names.

Other metadata did not match.

The DOJ alleged Raniere took the photos on the Canon. Using the camera card, he transferred them to a Dell Dimension.

The time he transferred them is unclear. The FBI did not find the Dell Dimension.

According to the metadata, Raniere transferred the photos on July 26, 2003 – two years before he took the photos. It was also one year before the manufacture of the camera.

FBI Senior Forensic Examiner Booth explained the contradictions of metadata. He testified that EXIF data is hard to change, so it is reliable.

The DOJ alleged Raniere backed up the Dell Dimension to a Western Digital hard drive.

Ten of the 11 adult women in the studies folder appear to have posed at 8 Hale. Daniela posed at 3 Flintlock, according to her testimony.

In the Studies folder:

43-58: Barbara Bouchey J [Ja]

59-70: Dawn –  D

71-78: Monica – MO

79-89: Kathy MSK [Miss Kathy]

90-98: Daniela -DF

99-109: Marianna and Pam MP

110-126: Loretta L

127-137: Marianna and Pam MP

138-149: Barbara Jeske BJ

150-163: CAMILA VC [Virgin Cami]

164-183: Angel – A

184-191: CAMILA VC

194-199: Kathy MSK

There were 168 photos in the 11 sub-folders of the Studies folder. The first one is a maple tree. It is in Barbara Bouchey’s folder.


There were anomalies in the metadata. This is not the time and place to get into the contradictions of the metadata.

Ivy was not in the Studies folder. Yet there were Adobe Photoshop thumbnails of Ivy and Raniere in Bouchey’s sub-folder. They were in a cache file. How did they get there?

These thumbnails suggest Raniere did not take all the photos.

There were thumbnails of Daniela in Kathy’s file and vice versa. This could happen if the two files had once been the same file.

Chakravorty retained Dr. J. Richard Kiper, a retired FBI trainer of forensic examiners.

Looking at the hard drive, Kiper concluded: The dates seem altered, but someone made manual errors to cover it up. One of the alterations appears to be an attempt to account for Daylight Saving Time.

Someone left a fingerprint of an alteration on a photo that shows how they changed the metadata.

This is undeniable proof that someone modified the metadata.

Some of these folders have manipulated file creation dates.

We will discuss this more in Part #7.